rndc(8) 맨 페이지 - 윈디하나의 솔라나라

분류: 서비스
설명: 맨 페이지 검색 (2016-02-22)
위치: 윈디하나의 솔라나라: rndc(8) 맨 페이지 (처음 오신 분은 윈디하나의 솔라나라 이야기를 읽어주십시오)
윈디하나의 솔라나라 트위터 @solanara

개요

솔라나라에 설명된 어플리케이션에 대해 맨 페이지를 찾아 출력한다.
MAN 페이지에 대한 설명은 윈디하나의 솔라나라: MAN 페이지을 참고하자.
svcadm(8)을 검색하려면 섹션에서 8 을 선택하고, 맨 페이지 이름에 svcadm을 입력하고 검색을 누른다.

rndc(8)

RNDC(8) BIND 9 RNDC(8)

NAME
rndc - name server control utility

SYNOPSIS
rndc [-b source-address] [-c config-file] [-k key-file] [-s server] [-p
port] [-q] [-r] [-V] [-y server_key] [[-4] | [-6]] {command}

DESCRIPTION
rndc controls the operation of a name server. If rndc is invoked with
no command line options or arguments, it prints a short summary of the
supported commands and the available options and their arguments.

rndc communicates with the name server over a TCP connection, sending
commands authenticated with digital signatures. In the current versions
of rndc and named, the only supported authentication algorithms are
HMAC-MD5 (for compatibility), HMAC-SHA1, HMAC-SHA224, HMAC-SHA256 (de‐
fault), HMAC-SHA384, and HMAC-SHA512. They use a shared secret on each
end of the connection, which provides TSIG-style authentication for the
command request and the name server's response. All commands sent over
the channel must be signed by a server_key known to the server.

rndc reads a configuration file to determine how to contact the name
server and decide what algorithm and key it should use.

OPTIONS
-4 This option indicates use of IPv4 only.

-6 This option indicates use of IPv6 only.

-b source-address
This option indicates source-address as the source address for
the connection to the server. Multiple instances are permitted,
to allow setting of both the IPv4 and IPv6 source addresses.

-c config-file
This option indicates config-file as the configuration file in‐
stead of the default, /etc/rndc.conf.

-k key-file
This option indicates key-file as the key file instead of the
default, /etc/rndc.key. The key in /etc/rndc.key is used to au‐
thenticate commands sent to the server if the config-file does
not exist.

-s server
server is the name or address of the server which matches a
server statement in the configuration file for rndc. If no
server is supplied on the command line, the host named by the
default-server clause in the options statement of the rndc con‐
figuration file is used.

-p port
This option instructs BIND 9 to send commands to TCP port port
instead of its default control channel port, 953.

-q This option sets quiet mode, where message text returned by the
server is not printed unless there is an error.

-r This option instructs rndc to print the result code returned by
named after executing the requested command (e.g., ISC_R_SUC‐
CESS, ISC_R_FAILURE, etc.).

-t timeout
This option sets the idle timeout period for rndc to timeout
seconds. The default is 60 seconds, and the maximum settable
value is 86400 seconds (1 day). If set to 0, there is no time‐
out.

-V This option enables verbose logging.

-y server_key
This option indicates use of the key server_key from the config‐
uration file. For control message validation to succeed,
server_key must be known by named with the same algorithm and
secret string. If no server_key is specified, rndc first looks
for a key clause in the server statement of the server being
used, or if no server statement is present for that host, then
in the default-key clause of the options statement. Note that
the configuration file contains shared secrets which are used to
send authenticated control commands to name servers, and should
therefore not have general read or write access.

COMMANDS
A list of commands supported by rndc can be seen by running rndc with‐
out arguments.

Currently supported commands are:

addzone zone [class [view]] configuration
This command adds a zone while the server is running. This com‐
mand requires the allow-new-zones option to be set to yes. The
configuration string specified on the command line is the zone
configuration text that would ordinarily be placed in
named.conf.

The configuration is saved in a file called viewname.nzf (or, if
named is compiled with liblmdb, an LMDB database file called
viewname.nzd). viewname is the name of the view, unless the view
name contains characters that are incompatible with use as a
file name, in which case a cryptographic hash of the view name
is used instead. When named is restarted, the file is loaded
into the view configuration so that zones that were added can
persist after a restart.

This sample addzone command adds the zone example.com to the de‐
fault view:

rndc addzone example.com '{ type primary; file "example.com.db";
};'

(Note the brackets around and semi-colon after the zone configu‐
ration text.)

See also rndc trace.

nta [(-class class | -dump | -force | -remove | -lifetime duration)]
domain [view]
This command sets a DNSSEC negative trust anchor (NTA) for do‐
main, with a lifetime of duration. The default lifetime is con‐
figured in named.conf via the nta-lifetime option, and defaults
to one hour. The lifetime cannot exceed one week.

A negative trust anchor selectively disables DNSSEC validation
for zones that are known to be failing because of misconfigura‐
tion rather than an attack. When data to be validated is at or
below an active NTA (and above any other configured trust an‐
chors), named aborts the DNSSEC validation process and treats
the data as insecure rather than bogus. This continues until the
NTA's lifetime has elapsed.

NTAs persist across restarts of the named server. The NTAs for a
view are saved in a file called name.nta, where name is the name
of the view; if it contains characters that are incompatible
with use as a file name, a cryptographic hash is generated from
the name of the view.

An existing NTA can be removed by using the -remove option.

An NTA's lifetime can be specified with the -lifetime option.
TTL-style suffixes can be used to specify the lifetime in sec‐
onds, minutes, or hours. If the specified NTA already exists,
its lifetime is updated to the new value. Setting lifetime to
zero is equivalent to -remove.

If -dump is used, any other arguments are ignored and a list of
existing NTAs is printed. Note that this may include NTAs that
are expired but have not yet been cleaned up.

Normally, named periodically tests to see whether data below an
NTA can now be validated (see the nta-recheck option in the Ad‐
ministrator Reference Manual for details). If data can be vali‐
dated, then the NTA is regarded as no longer necessary and is
allowed to expire early. The -force parameter overrides this be‐
havior and forces an NTA to persist for its entire lifetime, re‐
gardless of whether data could be validated if the NTA were not
present.

The view class can be specified with -class. The default is
class IN, which is the only class for which DNSSEC is currently
supported.

All of these options can be shortened, i.e., to -l, -r, -d, -f,
and -c.

Unrecognized options are treated as errors. To refer to a domain
or view name that begins with a hyphen, use a double-hyphen (--)
on the command line to indicate the end of options.

querylog [(on | off)]
This command enables or disables query logging. For backward
compatibility, this command can also be used without an argument
to toggle query logging on and off.

Query logging can also be enabled by explicitly directing the
queries category to a channel in the logging section of
named.conf, or by specifying querylog yes; in the options sec‐
tion of named.conf.

reconfig
This command reloads the configuration file and loads new zones,
but does not reload existing zone files even if they have
changed. This is faster than a full rndc reload when there is a
large number of zones, because it avoids the need to examine the
modification times of the zone files.

recursing
This command dumps the list of queries named is currently re‐
cursing on, and the list of domains to which iterative queries
are currently being sent.

The first list includes all unique clients that are waiting for
recursion to complete, including the query that is awaiting a
response and the timestamp (seconds since the Unix epoch) of
when named started processing this client query.

The second list comprises of domains for which there are active
(or recently active) fetches in progress. It reports the number
of active fetches for each domain and the number of queries that
have been passed (allowed) or dropped (spilled) as a result of
the fetches-per-zone limit. (Note: these counters are not cumu‐
lative over time; whenever the number of active fetches for a
domain drops to zero, the counter for that domain is deleted,
and the next time a fetch is sent to that domain, it is recre‐
ated with the counters set to zero).

refresh zone [class [view]]
This command schedules zone maintenance for the given zone.

reload This command reloads the configuration file and zones.

zone [class [view]]

If a zone is specified, this command reloads only the given
zone. If no zone is specified, the reloading happens asynchro‐
nously.

reset-stats <counter-name ...>
This command resets the requested statistics counters.

At least one counter name must be provided. Currently the fol‐
lowing counters are supported: recursive-high-water,
tcp-high-water.

responselog [on | off]
This command enables or disables response logging. For backward
compatibility, this command can also be used without an argument
to toggle response logging on and off.

Unlike query logging, response logging cannot be enabled by ex‐
plicitly directing the responses category to a channel in the
logging section of named.conf, but it can still be enabled by
specifying responselog yes; in the options section of
named.conf.

retransfer [-force] zone [class [view]]
This command retransfers the given secondary zone from the pri‐
mary server.

If the zone is configured to use inline-signing, the signed ver‐
sion of the zone is discarded; after the retransfer of the un‐
signed version is complete, the signed version is regenerated
with new signatures. With the optional -force argument provided
if there is an ongoing zone transfer it will be aborted before a
new zone transfer is scheduled.

scan This command scans the list of available network interfaces for
changes, without performing a full rndc reconfig or waiting for
the interface-interval timer.

secroots [-] [view ...]
This command dumps the security roots (i.e., trust anchors con‐
figured via trust-anchors, or the managed-keys or trusted-keys
statements [both deprecated], or dnssec-validation auto) and
negative trust anchors for the specified views. If no view is
specified, all views are dumped. Security roots indicate whether
they are configured as trusted keys, managed keys, or initializ‐
ing managed keys (managed keys that have not yet been updated by
a successful key refresh query).

If the first argument is -, then the output is returned via the
rndc response channel and printed to the standard output. Oth‐
erwise, it is written to the secroots dump file, which defaults
to named.secroots, but can be overridden via the secroots-file
option in named.conf.

섹션
맨 페이지 이름
검색(S)